Using GraphAPI to access a folder on a remote customer OneDrive folder (Not just my own OneDrive)

Dror 0

Hi,

I am trying to write a small application that connects to a customer's OneDrive and folder, then conducts a dir-list on that folder and downloads files from his Drive, which I later process on my application.

I've followed the official instructions describing how to configure the customer's Azure Portal's Active Directory and register a new application with ApplicationID, ClientSecret and proper API Permissions (File.ReadWrite, File.ReadWrite.AppFolder) , then made my application use GraphAPI to authenticate using those identifiers, fetch an access-token and connect using rest-api POST operation, then connecting and using rest-api GET operation to conduct a dir-list.

To my surprise the dir-list returned the directories and files of my own Drive - and NOT the customer's Drive...I can see or download only files from my own Drive, and the customer never see any files I Upload to any directory (of my own Drive, it seems...even though I connected with the customer supplied AppID and ClientSecret)

What am I missing here? Why doesn't the dir-list return the client's Drive and directory content instead of my own Drive's?

p.s I know of an alternative way, to make the customer manually share a folder and send a link by email, which when manually opened and clicked maps his remote folder to my drive, I did manage to scan this mapped folder (which now appears on my Drive) using GraphAPI and download a file, however it feels awkward to have to relay on manual links creation and emails, and I doubt that's the proper way for an application to do it.

Any advise?

Zehui Yao_MSFT 5,831 Reputation points

2023-03-31T09:16:08.83+00:00

Hi @Dror we are currently doing research on this issue and will let you know as soon as possible.
Anonymous

2023-03-31T13:32:35.2466667+00:00

Hi Dror, can you please decode your access token in https://jwt.io/ and check with the "tid" whether your customers tenant Id matches with that, and check with the delegated permissions of the userId you are trying to fetch the drive files.
Dror L 5 Reputation points

2023-04-03T20:02:56.1866667+00:00

Thanks for your reply, The replay I get from MSAL client.acquire token by authorization code is a dictionary, when I decode some of it's fields (like client_info or id_token) with the site you provided I get a certain TID. Looking in the customer Azure Portal I see my Tenant ID, which does NOT match the TID sent in the token (which might be my personal drive?), How can I change it?
Dror L 5 Reputation points

2023-04-03T20:33:12.67+00:00

Say I have two personal OneDrives - OneDrive A (which is connected to Email A on machine A) and OneDrive B (which is connected to Email B on machine B). I defined an application in my Azure Portal that belongs to OneDrive A (With AppID, Client-Secret, API Permissions...)

I now use machine A, login with Email A, run my application and get a valid access-token, with which I can get a legal dir-list of OneDrive A. I can also verify this using Microsoft Graph-Explorer: https://developer.microsoft.com/en-us/graph/graph-explorer using URL: https://graph.microsoft.com/v1.0/users/USERID/drive/special/approot/children if I set the request headers to "Authorization: Bearer MY ACCESS TOKEN A", I get Drive A dir-list under my application folder as requested - which is good.

However, I now go to machine B, login with email B (Which is connected to a different OneDrive B), run my application and get another access-token, this results in a different dir-list than before (Of OneDrive B, and not OneDrive A which I expected to get since that what the application AppId and ClientSecret and USERID I supplied are supposed to be connected to....)

In addition, When I try to use Graph-Explorer from machine B (with the same USERID of OneDrive A I used earlier), this time supplying the access-token I got from machine B application run to verify the results - I again get the dir-list of machine B... From the other hand, if I modify the request-headers "Authorization: Brearer" to be the access token A that I received earlier in machine A, I do get the right dir-list (of Drive A) from machine B...

Why is that...? It appears the generated access_token is defined by the email account you are logged in with, and not by the AppID/ClientSecret/UserID you supply? What can I do to change it? Obviously I can't use Email A from every customer machine I run my application from...there must be a way to make machine B (and any other machine) that runs the application to generate "the right access_ token" for accessing Drive A on which the application was registered in the Azure Portal?